eslint-plugin-weblint-security

Additional ESLint security rules for Javascript, React and Node.js / Express!

💿 Installation

Install ESLint either locally or globally. (Note that locally, per project, is strongly preferred)

$ npm install --save-dev eslint eslint-plugin-weblint-security

• Requires Node.js >=14.4.0
• Requires ESLint >=7.2.0
• Requires ES-Parser >=2020

🔧 Setup & Usage

Include Weblint security plugin in your .eslintrc.json configuration file ("env" required*):

{
    "env": {
        "browser": true,
        "es2020": true
    },
    "plugins": [
        "weblint-security"
    ].
    "extends": [
        "eslint:recommended",
        "plugin:weblint-security/recommended"
    ]
}

React support

For React projects, include the React specific rules and configurations:

{
    "env": {
        "browser": true,
        "es2020": true
    },
    "parserOptions": {
        "sourceType": "module"
    },
    "parser": "babel-eslint",
    "plugins": [
        "weblint-security"
    ],
    "extends": [
        "eslint:recommended",
        "plugin:weblint-security/recommended",
        "plugin:weblint-security/react"
    ]
}

Node.js support (including Express.js security aspects)

For Node.js projects, include the Node.js specific rules and configurations:

{
    "env": {
        "node": true
    },
    "parser": "babel-eslint",
    "plugins": [
        "weblint-security"
    ],
    "extends": [
        "eslint:recommended",
        "plugin:weblint-security/recommended",
        "plugin:weblint-security/nodejs"
    ]
}

📖 Rules

✒️ - the mark of fixable rules. Use eslint --fix . to apply all available fixes to your project.

Recommended base rules (@/recommended)

| Rule ID | Description | | |:--------|:------------|:--:| | no-href-and-src-inline-xss | Disallows unescaped variables of uncertain origin from href and src attributes, due to the concern that they might originate from user input. | ✒️ |

React specific rules (@/react)

| Rule ID | Description | | |:--------|:------------|:--:| | no-href-and-src-inline-xss-react | Disallows unescaped variables of uncertain origin from href and src JSX attributes, due to the concern that they might originate from user input. | ✒️ |

Node.js specific rules (@/nodejs)

| Rule ID | Description | | |:--------|:------------|:--:| | detect-sql-injection | Detect the usage of SQL queries that might be vulnerable to SQL Injections. | | | detect-missing-helmet | Disallow use of ExpressJS applications without the use of Helmet.js defaults, due to the concern that the HTTP headers might be insecurely configured. | ✒️ |

❤️ Contributions

We welcome contributions!

Please use GitHub's Issues/PRs.

Please make sure any contributions are covered within the tests, or that new tests are supplied for the contribution.

Testing the rules

To run the tests, use: npm test

Test coverage is achieved through the set of test files, located at: /tests/test-files/<relevant rule-name>/

All test files are prefixed with one of the following:

• valid_ for files that should give no output. Useful for testing false positives and soundness.

• invalid_ for files that should give some output. Useful for testing use-cases and completeness.

• fixed_ for files that contain the output of applying eslint --fix to some invalid_ file.